Password managers

[roubaixtuesday]

How do people keep track of passwords?

If you have a Google account, that comes with a password manager. Web browsers also remember passwords.

But how does this actually work - I presume you have to log out of and then back into services /apps whilst logged into your Google account for it to know what they are?

Can you retrieve passwords from the password manager to type in elsewhere or do you need to be logged in to the account on the same device?

And what's the advantage (if any) of paid for password managers?

And presumably using Google password manager essentially means that if your Google account is hacked the hackers instantly have access to absolutely everything (eg by grabbing your phone whilst unlocked)?

You can probably tell I'm extremely confused!

 

[twentysix by twentyfive]

I keep mine in a little notebook. Some of the web sites passwords are remembered on my PC (which I have allowed) but these are for web sites which I'm not overly concerned about. Banking etc is all paper and pen only. Maybe I'm paranoid about hackers but it doesn't mean that they aren't out to get me.

 

[Gunk]

Apple and Google kindly remember mine

 

[Ming the Merciless]

https://proton.me/pass

 

[wiggydiggy]

I'll remember your passwords so you don't have to, just call me on 0800 6665555 and tell me what you want to remember.

 

[Freeweel]

Password managers can create and recall far more complex passwords than the human brain would manage. Your pet name is guessable, _59jS?k(&£t.c0 isn't. If you use a password manager, you really only need to recall the password for the manager itself, or perhaps for one or two other accounts you want to isolate, like bank account or email.

Search engines often offer this function now. They'll offer to create a pword at the time of first login (sometimes a right click is needed on a computer) or to remember an existing pword if you already have an account. They then autopopulate your username and email address at subsequent logins. Two advantages: stronger/ unique pwords, and also, the browser will only auto complete you are on the right site. So if a scammer gets you to a fake website, you won't inadvertently give matwest.com your credentials.

You do have to be logged in... browsers let you do this across different devices.

Web browsers are recommended as a solution because they're far better than simply using 12345, password, or qwerty across every account, which lots of people do at present. But if you're hacked, it's comparatively easy to see what information is stored in your browser, which is why a standalone manager is better again.

Do some research and find a reputable one. Most of the reputable ones have an intro free level, and you're often paying for extra functionality like the ability to use across multiple devices.

Most people either use a weak password, or have a better one which they replicate across every online account they have. This means it only takes one compromise to make all of your account credentials guessable. Password managers avoid this amd are very worthwhile.

 

[Ming the Merciless]

Good old Facebook

https://arstechnica.com/security/20...lion-fine-for-storing-passwords-in-plaintext/

 

[slowmotion]

I keep mine in a little notebook. Some of the web sites passwords are remembered on my PC (which I have allowed) but these are for web sites which I'm not overly concerned about. Banking etc is all paper and pen only. Maybe I'm paranoid about hackers but it doesn't mean that they aren't out to get me.

I'm the same. I have a notebook for passwords that have anything to do with money. It's written in a pathetic code that I devised.

 

[Freeweel]

Good old Facebook

https://arstechnica.com/security/20...lion-fine-for-storing-passwords-in-plaintext/

That's why you shouldn't use the same password across multiple accounts. Which, with a password manager, you don't.​

Worth registering on haveibeenpwned.com which will tell you if your details have been breached via a company like this. Otherwise, you don't know until it's too late.

 

[richardfm]

I use Bitwarden https://bitwarden.com/

 

[Bristolian]

I have been using a password manager called Roboform (roboform.com) for about ten years(?). It not only stores passwords but can generate them for you in the first place. You can set the length of the password and which "special" characters can be included. It automatically syncs across all my devices, irrespective of operating system, so when I generate a new password on one device all the other devices have the new password when I power them up. On my desktop PC I have to enter a master password to use the programme, on my Windows laptop I use the fingerprint pad in place of the master password and both my iOS devices use facial recognition.

 

[tom73]

Apple password app before that Apple Keychain.

 

[Alex321]

I use Lastpass. There is a free version, but I have the paid for one (£31.20 per, year) and since we also use Lastpass in my current employer, I have linked my personal account so that I can get at my personal logins while connected to the work one.

The main reason I went for the paid version was that I use it on several different device types (Windows PC, Android devices and Macbook), and the free one, while it can be used across devices, only if they are the same type of device.

If you want it to, it can store other details than just passwords, such as credit card details (I don't store those in it). And as wit Roboform (suggested above), it can generate passwords for you, making it much easier for yu to have different passwords for every site.

 

[stephec]

Forgive me for being a bit paranoid, but does that mean that a third party has your log in details for all your password protected locations, or is there some kind of safeguard where the third party can't access your accounts without authorisation from you?

 

[Freeweel]

Forgive me for being a bit paranoid, but does that mean that a third party has your log in details for all your password protected locations, or is there some kind of safeguard where the third party can't access your accounts without authorisation from you?

There are safeguards, tied up in significant layers of encryption. Only you can access your account. Unless, of course, you choose an unreputable and unknown password manager, based in a north korean teenager's bedroom, via a random internet search. 😉